AIF-C01 Cheatsheet — AI & Generative AI Fundamentals, AWS Service Map, RAG & Prompt Patterns

Keep this page open while drilling questions. AIF‑C01 rewards clean definitions, best-fit service selection, and risk-aware design (hallucinations, privacy, prompt injection, responsible use).

Quick facts (AIF-C01)

How AIF-C01 questions work (fast strategy)

• If the prompt says least operational effort, prefer managed services (and native integrations).
• If the question is about “improving factual accuracy,” the best answer is often grounding (RAG + citations) rather than “make the model bigger.”
• If the question is about “sensitive data,” the best answer usually includes least privilege, encryption, and minimizing what you send to the model.
• If the scenario includes “untrusted user input,” think prompt injection defenses and safe tool use (allowlists, scoped permissions).
• Read the last sentence first to capture the constraint (cost, latency, safety, compliance).

0) Core mental model: a GenAI app (with RAG)

    flowchart LR
	  U[User] --> A[App / API]
	  A -->|Prompt + context| FM[Foundation Model]
	  A -->|Embed query| E[Embeddings]
	  E --> VS[(Vector Store)]
	  VS -->|Top-k chunks| A
	  A -->|Policy filters| G[Guardrails / Moderation]
	  A -->|Logs/metrics| O[Observability]
	  A -->|AuthN/AuthZ| IAM[IAM / Identity]

RAG in one sentence: retrieve relevant private content, then ask the model to answer using only that content (ideally with citations).

1) AI/ML fundamentals (Domain 1)

Core terminology (must know)

Metrics (common, conceptual)

ML lifecycle (high level)

    flowchart LR
	  P[Define problem + metric] --> D[Collect/prepare data]
	  D --> T[Train + tune]
	  T --> E[Evaluate]
	  E --> DEP[Deploy]
	  DEP --> M[Monitor + feedback]
	  M --> D

Common best answer patterns:

• If you can’t define a metric or get data, ML is usually the wrong first move.
• Production ML needs monitoring (quality/latency/cost) and retraining plans.

2) Generative AI fundamentals (Domain 2)

Key GenAI terms (must know)

Prompting vs RAG vs fine-tuning (decision table)

GenAI limitations to recognize

• Factuality isn’t guaranteed → use grounding/citations and “unknown” responses.
• Context is limited → don’t paste entire corpora; retrieve and summarize.
• Outputs can be unsafe/biased → add guardrails, evaluation, and human review paths.
• Costs scale with tokens → control prompt size, choose smaller models when acceptable, cache repeated work.

3) AWS service map (what to pick when)

Foundation models and ML platforms

Pre-built AI services (use-case driven)

Common building blocks for GenAI apps (glue)

4) RAG: design notes that show up in exam scenarios (Domain 3)

RAG architecture (end-to-end)

    flowchart TB
	  subgraph Ingestion
	    S3[(Docs in S3)] --> C[Chunk + clean]
	    C --> EMB1[Create embeddings]
	    EMB1 --> VS[(Vector store)]
	  end
	
	  subgraph Answering
	    Q[User question] --> EMB2[Embed query]
	    EMB2 --> VS
	    VS --> K[Top-k chunks]
	    K --> P[Prompt template: instructions + context]
	    P --> FM[Foundation model]
	    FM --> A[Answer + citations]
	  end

High-yield design choices

• Chunking: smaller chunks improve precision; larger chunks improve context. The exam often wants “tune chunking for relevance.”
• Citations: if the requirement says “trust” or “audit,” add citations/source links.
• Freshness: if content changes often, prefer RAG over fine-tuning.
• Privacy: don’t send more data than needed; redact PII; restrict who can retrieve what (multi-tenant boundaries).

5) Prompt engineering patterns (Domain 3)

Techniques you should recognize

Prompt template (practical)

 1Goal: Answer the user question using ONLY the provided context.
 2Context:
 3<<<
 4{retrieved_chunks}
 5>>>
 6Rules:
 7- If the answer is not in the context, say "Insufficient context".
 8- Provide 2-3 bullet citations (source titles/ids).
 9Output format (JSON):
10{"answer":"...", "citations":[{"source":"...","quote":"..."}]}
11User question: {question}

Anti-prompt-injection rule of thumb

Treat user-provided text as data, not instructions. If the model is allowed to call tools/actions, use allowlists and scoped permissions.

6) Evaluation and monitoring (Domain 3)

What to evaluate

Common “best answers”:

• Use a representative test set (not just a few demos).
• Do A/B testing when changing prompts/models.
• Monitor production for quality regressions and abuse.

7) Responsible AI (Domain 4)

Responsible AI checklist (high signal)

• Define intended use + out-of-scope use (avoid “silent expansion”).
• Add human oversight for high-impact decisions.
• Evaluate for bias and document limitations.
• Implement safety policies (harmful content, privacy leakage).
• Be transparent with users (what it is, what it isn’t, how to verify).

Common risks and mitigations

8) Security, compliance, and governance (Domain 5)

Security “gotchas” the exam expects you to notice

• Over-permissive IAM roles (“*” actions/resources)
• Secrets embedded in prompts, logs, or code
• Sending unnecessary sensitive data to the model
• No audit trail for access and changes
• Tool use without constraints (model can “do anything”)

AWS controls to name in answers (by theme)

Next steps

• Use the Syllabus as your checklist (objective-by-objective).
• Use Practice to drill weak tasks fast.
• Use the Study Plan if you want a 30/60/90-day schedule.